Board logo

标题: ntel BIOS锁定机制包括可启用写入保护旁路的竞争条件 [打印本页]

作者: 合肥亮少    时间: 2015-12-24 11:55     标题: ntel BIOS锁定机制包括可启用写入保护旁路的竞争条件

故障现象:

Lenovo 安全公告:LEN-2015-001

潜在影响:拒绝服务、权限提升

重要性

摘要:

在采用仅依赖于两个特定 BIOS 写入锁定机制的 Intel 芯片组的计算机中,存在一个竞争条件。如果成功利用这一竞争条件,攻击者便可能覆盖、修改或损坏 BIOS 或某些 BIOS 数据结构。

描述:

在采用仅依赖于 BIOS_CNTL.BIOSWE(“BIOS Write Enable”)和 BIOS_CNTL.BLE(“BIOS Lock Enable”)字节作为 BIOS 写入锁定机制的 Intel 芯片组的计算机中,存在一个竞争条件。通过设计,当启用 BIOS_CNTL.BIOSWE 时,包含 BIOS 的可编程闪存可能会写入 BIOS。如果启用了 BIOS_CNTL.BLE,它会激活一种机制来验证通过 BIOS_CNTL.BIOSWE 启用 BIOS 写入的行为已获得授权。如果未经授权,则会禁用 BIOS_CNTL.BIOSWE,并会再次拒绝写入 BIOS。这一竞争条件存在于 BIOS_CNTL.BIOSWE 被攻击者启用与被计算机自动禁用的间隔时间内,它可能会使攻击者覆盖、修改或损坏 BIOS 或某些 BIOS 数据结构,例如用于安全引导的数据结构。


解决方案:

ThinkPad:

系统

状态

最低版本,

包括修复程序

链接

ThinkPad Edge E130

受到影响

H4ET93WW(2.53)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-edge-laptops/thinkpad-edge-e130/downloads/DS029430

ThinkPad Edge E145

受到影响

HSET58WW(2.03)

http://support.lenovo.com/my/ms/products/laptops-and-netbooks/thinkpad-edge-laptops/thinkpad-edge-e145/downloads/DS036720

ThinkPad Edge E431/E531

受到影响

HEET47WW(1.28)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-edge-laptops/thinkpad-edge-e431/downloads/DS035124

ThinkPad Edge E440/E540

受到影响

J9ET93WW(2.13)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-edge-laptops/thinkpad-edge-e440/downloads/DS037207

ThinkPad Edge E455/E555

受到影响

HTET35WW(1.07)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-edge-laptops/thinkpad-e455/downloads/DS100990

ThinkPad Edge S430

受到影响

GAET98WW(2.58)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-edge-laptops/thinkpad-edge-s430/downloads/DS029726

ThinkPad Helix

受到影响

GFET50WW(1.29)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-helix-series-laptops/thinkpad-helix-type-3xxx/downloads/DS034627

ThinkPad L430/L530

受到影响

G3ETA2WW(2.62)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-l-series-laptops/thinkpad-l530/downloads/DS029124

ThinkPad L440/L540

受到影响

J4ET69WW(1.69)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-l-series-laptops/thinkpad-l440/downloads/DS037206

ThinkPad S1 Yoga(非 vPro)

受到影响

GQET38WW(1.18)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-yoga-series-laptops/thinkpad-yoga/downloads/DS038334

ThinkPad S1 Yoga(vPro)

受到影响

B0ET22WW(1.09)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-yoga-series-laptops/thinkpad-yoga/downloads/DS038334

ThinkPad S431

受到影响

HFET34WW(1.11)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-s-series-laptops/thinkpad-s431/downloads/DS035164

ThinkPad S440

受到影响

J3ET60WW(1.60)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-s-series-laptops/thinkpad-s440/downloads/DS036070

ThinkPad S531

受到影响

GKET33WW(1.13)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-s-series-laptops/thinkpad-s531/downloads/DS035584

ThinkPad S540

受到影响

GPET59WW(1.59)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-s-series-laptops/thinkpad-s540/downloads/DS038373

ThinkPad T430

受到影响

G1ETA6WW(2.66)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t430/downloads/DS029252

ThinkPad T430s

受到影响

G7ETA1WW(2.61)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t430s/downloads/DS029724

ThinkPad T430u

受到影响

H6ET92WW(2.10)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t430u/downloads/DS031724

ThinkPad T431s

受到影响

GHET29WW(1.14)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t431s/downloads/DS034505

ThinkPad T440/T440s

受到影响

GJET79WW(2.29)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t440/downloads/DS035965

ThinkPad T440p

受到影响

GLET72WW(2.26)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t440p/downloads/DS037575

ThinkPad T530

受到影响

G4ETA2WW(2.62)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t530/downloads/DS029246

ThinkPad T540p

受到影响

GMET67WW(2.15)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t540p/downloads/DS038147

ThinkPad Tablet 10(32 位)

受到影响

GUET65WW(1.65)

http://support.lenovo.com/us/en/products/tablets/thinkpad-tablet-series/thinkpad-10/downloads/DS041534

ThinkPad Tablet 10(64 位)

受到影响

GWET24WW(1.24)

http://support.lenovo.com/us/en/products/tablets/thinkpad-tablet-series/thinkpad-10/downloads/DS041804

ThinkPad Tablet 2

受到影响

GEETC6WW(2.16)

http://support.lenovo.com/us/en/products/tablets/thinkpad-tablet-series/thinkpad-tablet-2/downloads/DS033365

ThinkPad Tablet 8(32 位)

受到影响

GTET67WW(1.67)

http://support.lenovo.com/us/en/products/tablets/thinkpad-tablet-series/thinkpad-8/downloads/DS040045

ThinkPad Tablet 8(64 位)

受到影响

GYET24WW(1.24)

http://support.lenovo.com/us/en/products/tablets/thinkpad-tablet-series/thinkpad-8/downloads/DS100744

ThinkPad Twist/Edge S230

受到影响

GDETA8WW(1.68)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-twist-series-laptops/thinkpad-twist-s230u/downloads/DS032000

ThinkPad W530

受到影响

G5ETA0WW(2.60)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-w-series-laptops/thinkpad-w530/downloads/DS029169

ThinkPad W540

受到影响

GNET67WW(2.15)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-w-series-laptops/thinkpad-w540/downloads/DS039077

ThinkPad X1 Carbon(20A7、20A8)

受到影响

GRET40WW(1.17)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x1-carbon-type-20a7-20a8/downloads/DS039782

ThinkPad X1 Carbon(34xx)

受到影响

G6ETA9WW(2.69)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x1-carbon-type-34xx/downloads/DS030684

ThinkPad X131e(AMD)

受到影响

G9ET98WW(2.58)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x131e/downloads/DS029771

ThinkPad X131e(Intel)

受到影响

G8ET99WW(2.59)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x131e/downloads/DS029771

ThinkPad X140e(AMD)

受到影响

GSET61WW(2.06)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x140e/downloads/DS038561

ThinkPad X230

受到影响

G2ETA2WW(2.62)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x230/downloads/DS029187

ThinkPad X230s

受到影响

GGET22WW(1.10)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x230s/downloads/DS034847

ThinkPad X230t

受到影响

GCETA0WW(2.60)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-tablet-laptops/thinkpad-x230-tablet/downloads/DS029683

ThinkPad X240/X240s

受到影响

GIET76WW(2.26)

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x240/downloads/DS035950

ThinkPad Yoga 11e

未受影响

ThinkCentre:

系统

状态

最低版本,

包括修复程序

链接

ThinkCentre E73z

未受影响

ThinkCentre E93

未受影响

ThinkCentre E93z

未受影响

ThinkCentre Edge 62z

受到影响

F8KT37A

http://support.lenovo.com/us/en/downloads/DS031473

ThinkCentre Edge 63z

受到影响

FQKT28A

http://support.lenovo.com/us/en/downloads/DS100926

ThinkCentre Edge 72

受到影响

F1KT68A

http://support.lenovo.com/us/en/downloads/ds029433

ThinkCentre Edge 72z

受到影响

F6KT40A

http://support.lenovo.com/us/en/downloads/DS029266

ThinkCentre M62z

受到影响

F0KT43A

http://support.lenovo.com/us/en/downloads/DS030249

ThinkCentre M72e(Ivy)

受到影响

F1KT68A

http://support.lenovo.com/us/en/downloads/ds029433

ThinkCentre M72e(Tiny)

受到影响

F4KT52A

http://support.lenovo.com/us/en/downloads/DS029184

ThinkCentre M72e(PCI)

受到影响

F9KT55A

http://support.lenovo.com/us/en/downloads/DS031119

ThinkCentre M72z

未受影响

ThinkCentre M73

未受影响

ThinkCentre M73 Tiny

未受影响

ThinkCentre M73z

未受影响

ThinkCentre M78

未受影响

ThinkCentre M78

未受影响

ThinkCentre M79

未受影响

ThinkCentre M83z

未受影响

ThinkCentre M92

受到影响

9SKT88A

http://support.lenovo.com/us/en/downloads/DS029265

ThinkCentre M92p

受到影响

9SKT88A

http://support.lenovo.com/us/en/downloads/DS029265

ThinkCentre M93z

未受影响

ThinkStation:

系统

状态

最低版本,

包括修复程序

链接

ThinkStation C30

(类型 1095、1096、1097)

受到影响

A1KT51A

http://support.lenovo.com/us/en/products/workstations/thinkstation-c-series-workstations/thinkstation-c30/downloads/DS028464

ThinkStation C30

(类型 1136、1137)

未受影响

ThinkStation D30

(类型 4223、4228、4229)

受到影响

A1KT51A

http://support.lenovo.com/us/en/products/workstations/thinkstation-c-series-workstations/thinkstation-c30/downloads/DS028464

ThinkStation D30

(类型 4353、4354)

未受影响

ThinkStation E31

受到影响

9SKT88A

http://support.lenovo.com/us/en/downloads/DS029265

ThinkStation E32

未受影响

ThinkStation P300

未受影响

ThinkStation P500

未受影响

ThinkStation P700

未受影响

ThinkStation P900

未受影响

ThinkStation S30(类型 0567、0568、0569、0606)

受到影响

A0KT51A

http://support.lenovo.com/us/en/products/workstations/thinkstation-c-series-workstations/thinkstation-c30/downloads/DS028464

ThinkStation S30(类型 4351、4352)

未受影响

ThinkServer & Storage:

系统

状态

ThinkServer RD330

未受影响

ThinkServer RD340

未受影响

ThinkServer RD350

未受影响

ThinkServer RD430

未受影响

ThinkServer RD440

未受影响

ThinkServer RD450

未受影响

ThinkServer RD530

未受影响

ThinkServer RD540

未受影响

ThinkServer RD550

未受影响

ThinkServer RD630

未受影响

ThinkServer RD640

未受影响

ThinkServer RD650

未受影响

ThinkServer RS140

未受影响

ThinkServer TD340

未受影响

ThinkServer TD350

未受影响

ThinkServer TS130

未受影响

ThinkServer TS140

未受影响

ThinkServer TS430

未受影响

ThinkServer TS440

未受影响

ThinkServer RQ940

未受影响

Lenovo 笔记本电脑:

系统

状态

最低版本,

包括修复程序

链接

B40-30/B50-30/E40-30

未受影响

B40-45/B50-45

未受影响

B40-70/B50-70/E40-70/E50-70

未受影响

B490

受到影响

H9ET90WW

http://support.lenovo.com/us/en/downloads/DS032260

Colombia Yoga 2 13

未受影响

E10

未受影响

Flex 10

未受影响

Flex 2 14/Flex 2 15(Haswell)

受到影响

A0CN36WW

http://support.lenovo.com/us/en/downloads/DS101193

Flex 2 14D/Flex 2 15D

受到影响

9FCN25WW

http://support.lenovo.com/us/en/downloads/DS101002

Flex 2 Pro-15(Broadwell)

受到影响

A9CN47WW

http://support.lenovo.com/us/en/downloads/DS101359

Flex 2 Pro-15(Haswell)

受到影响

B9CN17WW

http://support.lenovo.com/us/en/downloads/DS101359

Flex 3 11

未受影响

G40/50/70-70

受到影响

9ACN31WW(V31)

http://support.lenovo.com/us/en/downloads/DS100522

G40/50/70-80 Broadwell

受到影响

B0CN79WW

http://support.lenovo.com/us/en/downloads/DS102231

G40/50-30

受到影响

A7CN47WW

http://support.lenovo.com/us/en/products/laptops-and-netbooks/lenovo-g-series-laptops/g40-30-notebook-lenovo/downloads/DS100921

G40/50-45

未受影响

G40/50-75

未受影响

G410/G510

未受影响

G410s/G510s

未受影响

Hiking

未受影响

K2450

受到影响

J2ET40WW

http://support.lenovo.com/us/en/downloads/DS100835

K4450

受到影响

J8ET43WW

http://support.lenovo.com/us/en/downloads/DS101630

M50-70

受到影响

B3CN23WW

http://support.lenovo.com/us/en/downloads/DS101348

Miix 2 11

受到影响

97CN43WW

http://support.lenovo.com/us/en/downloads/DS101276

S20

未受影响

S310/S410

未受影响

S435/M40-35(YC)Beema

未受影响

Y40-70

未受影响

Y430P

未受影响

Y50-70/Y70-70

未受影响

Yoga 2 Pro

未受影响

Yoga 3 Pro

受到影响

A6CN49WW

http://support.lenovo.com/us/en/products/laptops-and-netbooks/yoga-series/yoga-3-pro-1370-laptop-lenovo/downloads/DS101338

Yoga 2 11

受到影响

92CN35WW

http://support.lenovo.com/us/en/downloads/DS100551

Yoga 2 11 HSW

未受影响

Yoga3 14

未受影响

Z40/50/70-70

受到影响

9BCN31WW

http://support.lenovo.com/us/en/downloads/DS100528

Z40/50-75

未受影响

Lenovo 台式机:

系统

状态

最低版本,

包括修复程序

链接

63 台式机

未受影响

A540 一体机(Broadwell)

受到影响

O14KT15AUS

http://support.lenovo.com/us/en/downloads/DS102570

A740 一体机 - BDW

受到影响

O14KT15AUS

http://support.lenovo.com/us/en/downloads/DS102570

B40-30 一体机

受到影响

O0CKT23A

http://support.lenovo.com/us/en/downloads/DS101240

B40-30 触控式一体机

受到影响

O0CKT23A

http://support.lenovo.com/us/en/downloads/DS101240

B50-30 一体机

未受影响

B50-30 触控式一体机

未受影响

B5035

未受影响

B50-35 一体机

未受影响

C20-05 一体机

未受影响

C20-30 一体机

未受影响

C260 一体机

受到影响

IXKT26AUS

http://support.lenovo.com/us/en/products/desktops-and-all-in-ones/lenovo-c-series-all-in-ones/lenovo-c260-all-in-one/downloads/DS100767

C260 触控式一体机

受到影响

IXKT26AUS

http://support.lenovo.com/us/en/products/desktops-and-all-in-ones/lenovo-c-series-all-in-ones/lenovo-c260-all-in-one/downloads/DS100767

C360 一体机

未受影响

C365 一体机

未受影响

C40-05 一体机

未受影响

C40-30 一体机

未受影响

C460 一体机

未受影响

C470 一体机

未受影响

C50-30 一体机

受到影响

O0IKT17A

http://support.lenovo.com/us/en/downloads/DS101470

C5030 非触控式一体机

受到影响

O0IKT17A

http://support.lenovo.com/us/en/downloads/DS101470

C560 一体机

未受影响

E50-00 台式机

受到影响

O07KT52AUS

http://support.lenovo.com/us/en/products/desktops-and-all-in-ones/e-series-desktop/lenovo-e50-00-desktop/downloads/DS101341

ErazerX700 台式机

未受影响

H30-00 台式机

受到影响

O07KT52AUS

http://support.lenovo.com/us/en/products/desktops-and-all-in-ones/e-series-desktop/lenovo-e50-00-desktop/downloads/DS101341

H30-05 台式机

未受影响

H30-50 台式机

未受影响

H50-00 台式机

受到影响

O07KT52AUS

http://support.lenovo.com/us/en/products/desktops-and-all-in-ones/e-series-desktop/lenovo-e50-00-desktop/downloads/DS101341

H50-05 台式机

未受影响

H50-30g 台式机

未受影响

H50-50 台式机

未受影响

H530 台式机

未受影响

H530s 台式机

未受影响

Horizon 2 27 平板电脑

未受影响

Horizon2e 桌面计算机

未受影响

Horizon2s 桌面计算机

未受影响

M4350 台式机

未受影响

S40-40 一体机

未受影响


备注:

致谢:

谨此对报告此漏洞的 Corey Kallenberg 和 Rafal Wojtczuk 表示感谢。此问题还由 MITRE Corporation 的 John Butterworth 和 Sam Cornwell 通过独立方式共同发现。

其他信息和参考资料:

CERT Vulnerability Note:VU#766164

CVE ID:CVE-2014-8273

“Speed Racer”白皮书

http://cwe.mitre.org/data/definitions/362.html

http://www.intel.com/content/www/us/en/chipsets/6-chipset-c200-chipset-datasheet.html

http://www.intel.com/content/dam/www/public/us/en/documents/datasheets/8-series-chipset-pch-datasheet.pdf

修订历史:

版本

日期

描述

1.2

2015 年 6 月 25 日

发布其他修复程序

1.1

2015 年 5 月 17 日

发布其他修复程序

1.0

2015 年 4 月 10 日

初始版本






欢迎光临 合肥本本之星 合肥Thinkpad专卖店 合肥Apple专卖店 hfthink 合肥本之星信息科技有限公司 (http://hfthink.net/) Powered by Discuz! 7.2